Hey Guys welcome to capturing network traffic with wireshark.
Previously we introduced network forensics.
Now we're going to introduce Wireshark and show a practical scenario of acquiring or capturing network
packets using this popular and effective tool.
Wireshark is a wide open source tool for capturing filtering and analyzing network traffic and is installed
by default and Kelly Linux.
Wireshark is the successor of death or real.
Originally released in 1998 it allows to capture Packett on any type of network interface provided admin
privileges and the support of the network card for packet sniffing which is also called promiscuous
mode.
Besides capturing wireshark is also a powerful packet analyzer.
It supports several network protocols.
It's based on the lippie kept libraries the same way which also the popular Selye tool TCAP dump is
based.
For more info about wireshark we can refer to the official Web site wireshark dot org.
Let's run Wireshark and explore its interface and main features particularly those relative to the network
traffic capture to run the program.
We click on the Applications menu then on sniffing at spoofing and wireshark the main window shows the
capture mode with a list of network interface is available on the system and the relative graphs on
the right hand showing their activities.
If we move the mouse on the graph or on the name of the interface we see the details such as IP and
MAC addresses.
If we want to start capturing traffic we must select an interface and then click on the relative icon.
Start capturing packets.
We can also set filters on the capture traffic using the preconfigured ones or creating new ones.
To do that we click on capture capture filters that we could select the preconfigured filter or create
a new one by clicking on the plus sign.
The filters can be based on the protocol the IP address and or the port.
Clicking on capture options we can manage the network interface and configure the settings about the
output capture file and the display options and name resolution.
We're going to see a practical scenario of capturing the traffic generated by a simulated exploitation
of a vulnerability and a Unix daemon.
The unreal I.R.S. daemon to do so we use an intentionally vulnerable virtual machine métis point table
2 which also has this vulnerable daemon exposed menace multi-table to can be downloaded from this page.
A tutorial on how to install Mehta's play table 2 on a virtual box host only network VM is available
at this page.
We start the Mehta's ploy table 2 virtual machine.
If we click on the network settings we notice that the network adapter is attached to the host only
network and the associated virtual interface on the host named the box.
Net Zero.
Now we log into the métis point VM with NSF admin username and password.
We execute the config tool to check the IP address associated with the network interface of the VM.
We noticed that the IP address is one eighty two point one sixty eight point fifty six point 101.
We go back to Wireshark and select the host virtual interface V box net zero that has the IP address.
One ninety two point 168 point 5.6 point one to start capturing on this interface we click on the button
with the shark fin.
Now we open the métis poit console in a shell on the Kelly Linux host running the command and have console
running the command MSF Consul a consul with the MSF prompt should appear.
We select the exploit to use with the use command.
When we selected the exploit we can look at the corresponding modules available options with the options
command.
We noticed that the remote port our port is already set to the default I.R.S. port 6 6 6 7 while the
remote host IP is not set.
We set it with the set command
the IP address is the one associated to the network interface of the VM which is one ninety two point
sixty eight point fifty six point one to one.
Now we execute the run command to execute the exploit.
The result is that the exploit response always binds shell with the target.
So we execute command on it with the root privilege.
For example we can do directory listing and display the etc password file
and display the password file.
We go back to Wireshark and stop capturing clicking on the red stop button as you notice.
Wireshark displays the list of capture packets with all the relative info in the upper Panne while the
middle Panchos the packets details and the lower Panchos the hexadecimal view of the packets.
We save the capture traffic to an output file with the opposite button.
We get the file name as attack and save it in the default output format which is picaxe dash MGE.
Great job in this video we introduced Wireshark and showed a practical scenario for capturing network
traffic between two hosts between two hosts on the same network in the next video.
We'll see how to analyze capture network traffic with wireshark.